CVE-2023-22893 Strapi does not verify the access or ID tokens issued during the OAuth flow

What is CVE-2023-22893?

CVE-2023-22893 is a high-severity authentication bypass vulnerability in n/a, published on 19 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

Weakness: CWE-287

Which versions are affected by CVE-2023-22893?

2 open source packages ship an affected version, including @strapi/plugin-users-permissions. It affects 1 product.

Products include Strapi Strapi.

How do I fix CVE-2023-22893?

Upgrade @strapi/plugin-users-permissions to 4.6.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-22893 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22893 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in n/a

• CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Exploited High 7.2
• CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin Critical 10.0
• CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi Critical 9.8
• CVE-2020-27664 Authorization bypass in Strapi Critical 9.8
• CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-583x-23h9-f5w7.